Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Smitfraud 888 Toolbar-c


  • Please log in to reply
9 replies to this topic

#1 rhonds

rhonds

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 15 June 2007 - 11:47 AM

A while ago my daughter clicked on a 'this is a picture of you link'. Since then we've been beseiged with viruses, pop-ups, ads etc. I'v tried everything I can think of, including your smitfraud fix, but nothing will get rid of the smitfraud bit. Adaware gets rid of the hitchhikers and spybot thinks it gets rid of the smitfraud but it doesn't. The HijackThis log is below. any ideas would be great!
Rhonda






Logfile of HijackThis v1.99.1
Scan saved at 12:39:13 AM, on 16/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\acer\Acer eConsole\MediaServerService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\neordefh.dll",realset
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/w...ntrol_en_US.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://the-seedy-wagon.spaces.msn.com//Pho...ad/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://dolalol.landonline.com.au/iws/panai...plugins/ncs.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {DD3641E5-A9CF-11D1-9AA1-444553540000} (Surround Video V3.0 Control Object) - http://www.imperialsurf.com.au/virtual-tou...abs/svideo3.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15021/CTPID.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

BC AdBot (Login to Remove)

 


#2 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:08:39 AM

Posted 15 June 2007 - 12:18 PM

Hello there and welcome to Bleeping Computer's security forum.
My name is David, I will be helping you with your log today.

It is a good idea to print off these instructions. There is a possibility some of the instructions will need to be carried out where internet access is not available. It is important that you complete the instructions in the right order, and that you don't miss out any steps.

Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present:

O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\neordefh.dll",realset

Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Please download VundoFix.exe to your desktop
Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.
Note: It is possible that VundoFix encountered a file it could not remove.
VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.

#3 rhonds

rhonds
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 15 June 2007 - 09:55 PM

Hi David,

I followed all your instructions (nice and clear BTW, thank you). the Vundo and HijackThis logs are below.

Cheers
Rhonda



VundoFix V6.5.0

Checking Java version...

Java version is 1.5.0.2
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 10:39:58 AM 16/06/2007

Listing files found while scanning....

C:\WINDOWS\system32\bfucybqm.dll
C:\windows\system32\biefdhix.ini
C:\windows\system32\biefdhix.ini2
C:\WINDOWS\system32\fdloabaa.dll
C:\WINDOWS\system32\ggakxnes.dll
C:\WINDOWS\system32\kkwokvow.dll
C:\WINDOWS\system32\nboalqja.dll
C:\WINDOWS\system32\pqstv.bak1
C:\WINDOWS\system32\pqstv.bak2
C:\WINDOWS\system32\pqstv.ini
C:\WINDOWS\system32\pqstv.ini2
C:\WINDOWS\system32\pqstv.tmp
C:\WINDOWS\system32\qomnomm.dll
C:\WINDOWS\system32\vnudbcul.dll
C:\WINDOWS\system32\vtsqp.dll
C:\windows\system32\xihdfeib.dll

Beginning removal...

Attempting to delete C:\windows\system32\biefdhix.ini
C:\windows\system32\biefdhix.ini Has been deleted!

Attempting to delete C:\windows\system32\biefdhix.ini2
C:\windows\system32\biefdhix.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\pqstv.bak1
C:\WINDOWS\system32\pqstv.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\pqstv.bak2
C:\WINDOWS\system32\pqstv.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\pqstv.ini
C:\WINDOWS\system32\pqstv.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\pqstv.ini2
C:\WINDOWS\system32\pqstv.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\pqstv.tmp
C:\WINDOWS\system32\pqstv.tmp Has been deleted!

Attempting to delete C:\WINDOWS\system32\vtsqp.dll
C:\WINDOWS\system32\vtsqp.dll Has been deleted!

Attempting to delete C:\windows\system32\xihdfeib.dll
C:\windows\system32\xihdfeib.dll Has been deleted!

Performing Repairs to the registry.
Done!


Logfile of HijackThis v1.99.1
Scan saved at 10:50:41 AM, on 16/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\acer\Acer eConsole\MediaServerService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {889F837C-9DA4-42B8-ADDC-6CC842231F5f} - C:\WINDOWS\system32\dcoetjyo.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {92A444D2-F945-4dd9-89A1-896A6C2D8D22} - C:\WINDOWS\system32\gutkilse.dll (file missing)
O2 - BHO: (no name) - {B37DC9A5-3576-4F67-BE78-B32CFBFC4B6D} - C:\WINDOWS\system32\vtsqp.dll (file missing)
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/w...ntrol_en_US.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://the-seedy-wagon.spaces.msn.com//Pho...ad/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://dolalol.landonline.com.au/iws/panai...plugins/ncs.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {DD3641E5-A9CF-11D1-9AA1-444553540000} (Surround Video V3.0 Control Object) - http://www.imperialsurf.com.au/virtual-tou...abs/svideo3.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15021/CTPID.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: qomnomm - qomnomm.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

#4 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:08:39 AM

Posted 16 June 2007 - 03:18 AM

Good work! Let's continue.. :thumbsup:

It is a good idea to print off these instructions. There is a possibility some of the instructions will need to be carried out where internet access is not available. It is important that you complete the instructions in the right order, and that you don't miss out any steps.

Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {889F837C-9DA4-42B8-ADDC-6CC842231F5f} - C:\WINDOWS\system32\dcoetjyo.dll (file missing)
O2 - BHO: (no name) - {92A444D2-F945-4dd9-89A1-896A6C2D8D22} - C:\WINDOWS\system32\gutkilse.dll (file missing)
O2 - BHO: (no name) - {B37DC9A5-3576-4F67-BE78-B32CFBFC4B6D} - C:\WINDOWS\system32\vtsqp.dll (file missing)
O20 - Winlogon Notify: qomnomm - qomnomm.dll (file missing)

Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Run HijackThis.
On the first menu, click Open the Misc Tools Section
Click Open Uninstall Manager
Click Save List - Save it anywhere.
A notepad will pop-up after it's saved, please copy everything in that Notepad and paste it here.

Please perform this online scan: Kaspersky Webscan
Read the Requirements and Privacy statement, then select "Accept"
A dialogue box will appearing asking "Do you want to install this software?" Name: kavwebscan_unicode.cab
Select "Install" to download the ActiveX controls that allows ActiveScan to run.
When the download is complete it will say ready, click "Next"
Select a target to scan: Click on "My Computer"
When the scan is complete choose to save the results as "Save as Text"
Post the Kaspersky scan results in your next reply, along with a new Hijackthis log.

Don't forget the uninstall list too! :flowers:

#5 rhonds

rhonds
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 16 June 2007 - 06:45 AM

Ok. That's all done. See following the uninstall list, the kaspersky report and the HijackThis log:

Acer eConsole
Acer eMode Management
Ad-Aware SE Personal
Adobe Photoshop 7.0
Adobe Reader 7.0
Agere Systems PCI Soft Modem
Apple Software Update
Avanquest update
Creative MediaSource
Creative Removable Disk Manager
Creative System Information
Creative Zen MicroPhoto
DivX
DivX Converter
DVD-TO-MPEG V1.9
Google Earth
HijackThis 1.99.1
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB929120)
Image Web Server IE Plugins 1,7,1,43
iPod for Windows 2005-09-23
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java™ SE Runtime Environment 6 Update 1
LimeWire 4.10.0
Lizardtech DjVu Control (autoinstall)
Macromedia Flash Player 8
Macromedia Shockwave Player
Marble Drop
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft Age of Empires Gold
Microsoft Encarta Interactive World Atlas 2000
Microsoft Home Publishing 2000
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Excel Viewer 2003
Microsoft Word 2000
Microsoft Works 2000
Microsoft Works 2000 Setup Launcher
Motorola Phone Tools
MSN
Network Play System (Patching)
NOD32 antivirus system
NTI Backup NOW! 4
NTI CD & DVD-Maker
NTI HomeVideo-Maker
Panda ActiveScan
PowerDVD
PQ DVD to iPod Video Converter (remove only)
QuickTime
QuickTime 3.0
Realtek AC'97 Audio
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Spybot - Search & Destroy 1.4
Sygate Personal Firewall
The Sims Hot Date
Theme Park World
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Video Converter
Windows Defender
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893086
Word in Works Suite add-in
XviD 1.1 final uninstall



-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, June 16, 2007 7:38:46 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 16/06/2007
Kaspersky Anti-Virus database records: 347427
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
G:\
H:\
I:\
J:\

Scan Statistics:
Total number of scanned objects: 99547
Number of viruses found: 11
Number of infected objects: 106
Number of suspicious objects: 7
Duration of the scan process: 00:51:13

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\ysycowfw.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\qbjhsuln.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\lkgpgfau.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\iloifxwh.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\hlpygmyj.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\aofrfgid.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\mcijbqpx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\ikxuvumw.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\ffaplwwh.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\ywtlwnkp.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\rfyhwdvt.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\sbglawdh.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\siswsofq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\neordefh.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\tjrhdcib.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\xttcsqkp.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\xgwqxhvp.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\yaokxarj.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\hxsexrfp.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\afiefhmy.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\system32\qeakloow.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{C839D33F-10CF-4279-847C-C6E699D3EE40}.bin Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-04062007-190842.log Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Family\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Family\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\srvvnosp.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\mtqmadih.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\JETB8D6.tmp Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\~DF3315.tmp Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\bigncast.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\axtncxrr.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\sgjlgjxd.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\qhgwbmml.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\eeanqacx.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\jyrcvjgp.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\vsseagjk.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\~DF331E.tmp Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\acktlrcs.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\mfemrjba.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\arnsupfx.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\iolhetka.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\wayjafdt.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\ohfcasln.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\tmjjlgui.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\hrbxatji.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\pokchbbg.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\aqjrmvcx.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\dmucxfeb.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\otbvtadc.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\xgdttbpf.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\neaxstbu.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\ywqrlcvs.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\gdfesxbm.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\djarrmwe.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\wkdjcxyy.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\ixupwxxo.dll Suspicious: Packed.Win32.Morphine.a skipped
C:\Documents and Settings\Family\Local Settings\Temp\tcvqmkue.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\ahvfnodj.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\lrvpvdji.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\spkwfnxg.dll Suspicious: Packed.Win32.Morphine.a skipped
C:\Documents and Settings\Family\Local Settings\Temp\ltaetmyb.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\yqocecor.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\yvhqoutw.dll Suspicious: Packed.Win32.Morphine.a skipped
C:\Documents and Settings\Family\Local Settings\Temp\bqujpice.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\wekvjgor.dll Suspicious: Packed.Win32.Morphine.a skipped
C:\Documents and Settings\Family\Local Settings\Temp\awhkdqiw.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\cvudupru.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\hldeuhpq.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\qqcdkita.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\rormjjnw.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\jqpkkuhg.dll Suspicious: Packed.Win32.Morphine.a skipped
C:\Documents and Settings\Family\Local Settings\Temp\gjsydcdp.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\niikxonb.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\dvyguxrw.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\iovknphp.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\wnftujur.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\engpjrsq.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\qsclqdyr.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\yjashmvt.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\susgllox.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\skioofag.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\ldceflpx.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\ewyuuaac.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\egkyntjo.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\onlgjkyy.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\uibrsien.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\ppophexo.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\wsaaiayl.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\ivdvvahf.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\igpdjsjo.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\uqshvfex.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\mrdteuse.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\vwngqyxy.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\hsxgldyu.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\wlcjnmfh.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\sbttyawg.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\yqifycyo.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\glpndoks.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\gdqyipdp.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\kbjuunmx.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\xkujxkdv.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\nypjduwi.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\eeabxxky.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\dicvojvr.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\iyqesdph.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\neyqkcjs.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\oybeynwv.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\nkggppdh.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\gmdxboki.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\aqpphjbb.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\brblmyep.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\hacocjym.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\xtyvqxlv.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\nnrvwjyb.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\xarkquqk.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\Local Settings\Temp\gveunxqu.dll Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temp\MPSampleSubmit\vtsqp.dll.xor Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped
C:\Documents and Settings\Family\Local Settings\Temp\Temporary Internet Files\Content.IE5\CDK9CL46\spl[1].htm Infected: Trojan-Downloader.JS.Small.cn skipped
C:\Documents and Settings\Family\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Family\Local Settings\History\History.IE5\MSHist012007061620070617\index.dat Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Family\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Family\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Family\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Family\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\Family\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Family\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Family\.housecall6.6\Quarantine\fillmem[1].htm.bac_a03248 Infected: Exploit.JS.CVE-2005-1790.q skipped
C:\Documents and Settings\Family\.housecall6.6\Quarantine\xivrpbcf.dll.bac_a03248 Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Family\.housecall6.6\Quarantine\hbtpilvj.dll.bac_a03248 Infected: not-a-virus:AdWare.Win32.Virtumonde.ar skipped
C:\Documents and Settings\Family\.housecall6.6\Quarantine\index[18].htm.bac_a03248 Infected: Trojan.JS.Redirector.a skipped
C:\Documents and Settings\Ashleigh\Local Settings\Temp\yuggvxoc.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Ashleigh\Local Settings\Temp\nnblpbyk.dll Suspicious: Packed.Win32.Morphine.a skipped
C:\Documents and Settings\Ashleigh\Local Settings\Temp\rkwwpqyt.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Documents and Settings\Ashleigh\Local Settings\Temp\pehnhwqa.dll Object is locked skipped
C:\Documents and Settings\Ashleigh\Local Settings\Temp\spbgsvbb.dll Infected: Trojan-Spy.Win32.VBStat.h skipped
C:\Program Files\acer\Acer eConsole\AcerDB.mdb Object is locked skipped
C:\Program Files\acer\Acer eConsole\AcerDB.ldb Object is locked skipped
C:\Program Files\Sygate\SPF\debug.log Object is locked skipped
C:\Program Files\Sygate\SPF\syslog.log Object is locked skipped
C:\Program Files\Sygate\SPF\seclog.log Object is locked skipped
C:\Program Files\Sygate\SPF\tralog.log Object is locked skipped
C:\Program Files\Sygate\SPF\rawlog.log Object is locked skipped
C:\Program Files\ESET\logs\virlog.dat Object is locked skipped
C:\Program Files\ESET\logs\warnlog.dat Object is locked skipped
C:\Program Files\ESET\cache\CACHE.NDB Object is locked skipped
C:\Program Files\ESET\infected\50DQDVAA.NQF Infected: not-a-virus:AdWare.Win32.BHO.v skipped
C:\Program Files\ESET\infected\ZQZQC2BA.NQF Infected: not-a-virus:Downloader.Win32.WinFixer.i skipped
C:\Program Files\ESET\infected\Z00NFJCA.NQF Suspicious: Packed.Win32.Morphine.a skipped
C:\Program Files\ESET\infected\L5SRIFBA.NQF Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped
C:\System Volume Information\_restore{32C1D3EE-62E1-4318-A1DD-66D71B99ADB2}\RP1\A0000030.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ic skipped
C:\System Volume Information\_restore{32C1D3EE-62E1-4318-A1DD-66D71B99ADB2}\RP1\A0000031.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ar skipped
C:\System Volume Information\_restore{32C1D3EE-62E1-4318-A1DD-66D71B99ADB2}\RP1\change.log Object is locked skipped
C:\VundoFix Backups\xihdfeib.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ar skipped

Scan process completed.


Logfile of HijackThis v1.99.1
Scan saved at 7:40:31 PM, on 16/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\acer\Acer eConsole\MediaServerService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/w...ntrol_en_US.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://the-seedy-wagon.spaces.msn.com//Pho...ad/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://dolalol.landonline.com.au/iws/panai...plugins/ncs.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {DD3641E5-A9CF-11D1-9AA1-444553540000} (Surround Video V3.0 Control Object) - http://www.imperialsurf.com.au/virtual-tou...abs/svideo3.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15021/CTPID.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe


Cheers
Rhonda

#6 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:08:39 AM

Posted 16 June 2007 - 06:57 AM

Good work! Let's continue.. :thumbsup:

It is a good idea to print off these instructions. There is a possibility some of the instructions will need to be carried out where internet access is not available. It is important that you complete the instructions in the right order, and that you don't miss out any steps.

Download KillBox from the following link :
http://www.bleepingcomputer.com/files/killbox.php
Unzip the folder to your desktop.

Click on start, then control panel, and then double-click on add/remove programs.
From within add/remove program uninstall the following if they exist by double-clicking on the following entries:

J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9


Start Killbox.exe
Select the "Delete on Reboot" option.
Click on the "All Files" button (!important!),which will then flash green.
Copy the complete text in bold below to the clipboard by highlighting the filepaths and pressing Control + C:

C:\WINDOWS\system32\ysycowfw.dll
C:\WINDOWS\system32\qbjhsuln.dll
C:\WINDOWS\system32\lkgpgfau.dll
C:\WINDOWS\system32\iloifxwh.dll
C:\WINDOWS\system32\hlpygmyj.dll
C:\WINDOWS\system32\aofrfgid.dll
C:\WINDOWS\system32\mcijbqpx.dll
C:\WINDOWS\system32\ikxuvumw.dll
C:\WINDOWS\system32\ffaplwwh.dll
C:\WINDOWS\system32\ffaplwwh.dll
C:\WINDOWS\system32\ffaplwwh.dll
C:\WINDOWS\system32\sbglawdh.dll
C:\WINDOWS\system32\siswsofq.dll
C:\WINDOWS\system32\neordefh.dll
C:\WINDOWS\system32\tjrhdcib.dll
C:\WINDOWS\system32\xttcsqkp.dll
C:\WINDOWS\system32\xgwqxhvp.dll
C:\WINDOWS\system32\yaokxarj.dll
C:\WINDOWS\system32\hxsexrfp.dll
C:\WINDOWS\system32\afiefhmy.dll
C:\WINDOWS\system32\qeakloow.dll


Open 'file' in the killboxmenu on top and choose Paste from clipboard
You must use the file File menu--pasting by right-clicking the mouse will only enter one file.
Then press the button that looks like a red circle with a white X in it.
Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to Reboot now, click "yes".
Click OK at any Pending File Rename Operations prompt, let me know if there appear.
If you don't get that message, reboot manually.
Your computer should reboot now.

Now reboot into Safe Mode.
This can be done tapping the F8 key as soon as you start your computer
You will be brought to a menu where you can choose to boot into safe mode.
Make sure you choose the option without networking support.

I want you to clean your cache and cookies from your internet explorer.
There are a few infected files which need to be removed from your system.

° Close all instances of Internet Explorer .
° Go to your control panel and open "Internet Options".
° Click on the "General" tab.
° Click the "Delete Cookies" button, then the "Delete Files" button.
° When prompted, place a tick in the "Delete all offline content" box and click OK.

Also, please clean other Temporary files and Empty the Recycle Bin

° Go to start and click on the "run" button.
° Type the following in the fox --> cleanmgr and click ok.
° Let it scan your system for files to remove.
° Make sure only Temporary Files, Temporary Internet Files, and Recycle Bin are checked.
° Press OK to remove them.

Reboot back to normal mode.

We need to purge your infected system restore points.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Check Turn off System Restore, click Apply, and then click OK.
More information on how to disable your system restore can be found here.

We want to create a new, clean restore point. Please first reboot your computer.
On the Desktop, right-click My Computer, then click Properties.
Click the System Restore tab near the top of the window.
Uncheck "Turn off System Restore", click Apply, and then click OK.

Click Start > All Programs > Accessories > System Tools, and select System Restore.
In the System Restore wizard, select the box next the text labeled "Create a restore point" and click the Next button.
Type a description for your new restore point - Something like "After trojan/spyware cleanup".
Click Create, and after it has created the restore point, click "Close".
Further instructions on creating a restore point can be found here

Please download Combofix to your desktop.
Doubleclick combofix.exe to launch the application.

Follow the prompts that will be displayed on the screen.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.

#7 rhonds

rhonds
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 16 June 2007 - 09:21 AM

All done. Just a couple of small things that didn't happen quite the way you suggested that may or may not be important:

1. when I was cleaning the cache/cookies etc thru control panel/internet options - 'delete all offline content' box never came up. The reasonable alternative seemed to be delete all and also delete files and settings stored by add-ons.

2. after I turned off system restore and rebooted, going thru start/.../system tools, system restore didn't give me a wizard to work with. all our accounts have adminstrator rights so I'm not sure why it happened. the only thing I could do was to turn restore back on.

Apart from that everything seemed to be fine. Logs are below:

ComboFix 07-06-13.3 - C:\Documents and Settings\Family\Desktop\ComboFix.exe
"Family" - 2007-06-16 21:55:33 - Service Pack 2


(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\ywtlwnkp.dll
C:\WINDOWS\system32\rfyhwdvt.dll
C:\WINDOWS\system32\pknwltwy.ini
C:\WINDOWS\system32\tvdwhyfr.ini
C:\WINDOWS\system32\pugnhbrr.tmp
C:\WINDOWS\system32\pugnhbrr.ini
C:\WINDOWS\system32\pugnhbrr.ini2


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\Family\APPLIC~1.\macromedia\Flash Player\#SharedObjects\XRC9VQV6\www.broadcaster.com
C:\DOCUME~1\Family\APPLIC~1.\macromedia\Flash Player\#SharedObjects\XRC9VQV6\www.broadcaster.com\played_list.sol
C:\DOCUME~1\Family\APPLIC~1.\macromedia\Flash Player\#SharedObjects\XRC9VQV6\www.broadcaster.com\video_queue.sol
C:\DOCUME~1\Family\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\DOCUME~1\Family\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol


((((((((((((((((((((((((( Files Created from 2007-05-16 to 2007-06-16 )))))))))))))))))))))))))))))))


2007-06-16 21:55 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-16 21:01 <DIR> d-------- C:\!KillBox
2007-06-16 18:22 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-06-16 18:22 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-06-16 10:39 <DIR> d-------- C:\VundoFix Backups
2007-06-16 00:02 60,496 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
2007-06-16 00:02 21,075 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2007-06-16 00:02 14,568 --a------ C:\WINDOWS\system32\drivers\wg6n.sys
2007-06-16 00:02 14,568 --a------ C:\WINDOWS\system32\drivers\wg5n.sys
2007-06-16 00:02 14,568 --a------ C:\WINDOWS\system32\drivers\wg4n.sys
2007-06-16 00:02 14,568 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
2007-06-16 00:01 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2007-06-16 00:01 <DIR> d-------- C:\Program Files\Sygate
2007-06-15 21:44 8,704 --a------ C:\WINDOWS\system32\pfdnnt.exe
2007-06-15 21:25 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-06-05 22:05 <DIR> d-------- C:\RAPTOR
2007-06-05 21:56 <DIR> d--h----- C:\WINDOWS\PIF
2007-06-05 18:27 72,192 --a------ C:\WINDOWS\system\GSWDLL.DLL
2007-06-05 18:27 398,416 --a------ C:\WINDOWS\system\VBRUN300.DLL
2007-06-05 18:27 286,720 --a------ C:\WINDOWS\system\GSW.EXE
2007-06-05 18:27 <DIR> d-------- C:\gaz2sw


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-14 14:13:42 3,818 ----a-w C:\WINDOWS\system32\tmp.reg
2007-04-25 14:21:16 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:24 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 14:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 14:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 14:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 14:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 14:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 14:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 14:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 14:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-01 14:55:58 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2007-03-17 13:43:02 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 01:56]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 01:04]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 20:33]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" []
"SoundMan"="SOUNDMAN.EXE" [2005-06-08 08:31 C:\WINDOWS\SOUNDMAN.EXE]
"ntiMUI"="c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 18:15]
"@"="" []
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-15 01:07]
"eRecoveryService"="C:\Program Files\Acer\eRecovery\Monitor.exe" [2005-06-20 09:03]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 09:06 C:\WINDOWS\AGRSMMSG.exe]
"VTTimer"="VTTimer.exe" [2005-05-13 12:57 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-05-13 12:57 C:\WINDOWS\system32\VTTrayp.exe]
"AspireService"="C:\Program Files\Acer\Acer eMode Management\AspireService.exe" [2005-06-04 12:40]
"MediaSync"="C:\Program Files\Acer\Acer eConsole\MediaSync.exe" [2005-06-01 14:25]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-04-01 22:55]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t


Contents of the 'Scheduled Tasks' folder
2007-06-16 10:56:30 C:\WINDOWS\tasks\{45CB2F47-86A0-4B94-B051-86A555A8E652}_DESKTOP_Family.job
2007-06-02 00:03:10 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-06-16 14:04:04 C:\WINDOWS\tasks\MP Scheduled Scan.job





Logfile of HijackThis v1.99.1
Scan saved at 22:13, on 2007-06-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\acer\Acer eConsole\MediaServerService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\ComboFix\catchme.cfexe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/w...ntrol_en_US.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://the-seedy-wagon.spaces.msn.com//Pho...ad/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://dolalol.landonline.com.au/iws/panai...plugins/ncs.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {DD3641E5-A9CF-11D1-9AA1-444553540000} (Surround Video V3.0 Control Object) - http://www.imperialsurf.com.au/virtual-tou...abs/svideo3.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15021/CTPID.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe


Thanks
Rhonda
PS: don't you ever sleep?

#8 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:08:39 AM

Posted 16 June 2007 - 12:30 PM

Great stuff, everything is looking squeaky clean! :thumbsup:

In regards to 'deleting offline content', are you sure you followed the instructions correctly?
It could be an error on my part; I'm running IE6 so it may be different - please let me know if it is.
After clicking the "delete cookies" button, you clicked on the "delete files" button?:
Posted Image

Then:
Posted Image
Let me know if you see differently..

Regarding system restore, as long as it is back on, you are fine there.
Please let me know how the system is running, I see a clean HJT log here!

#9 rhonds

rhonds
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:39 PM

Posted 16 June 2007 - 10:29 PM

Yay! Thank you so much for your help.

explorer 7 is a bit different. I've been trying to do a screen dump to show you, but my IT skills are a tad rusty. Basically you go to 'delete browsing history' and it lists 'temporary internet files', 'cookies', 'history' 'form data' and 'passwords' with their own 'delete' buttons, or else at the bottom of the screen you can 'delete all'.

Everything seems to be running smoothly. Except I think I've told the firewall to block a couple of things that are actually coming from microsoft. I just need to unblock them and it'll all be dandy.

Cheers
Rhonda

#10 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:08:39 AM

Posted 17 June 2007 - 03:53 AM

Thanks Rhonda, I will edit my canned speech accordingly!

Glad I could help! :flowers:
The latest log is looking clean!
Follow this list and your potential for being infected again will be reduced dramatically.

Use an Anti Virus Software -
* It is very important that your computer has an anti-virus software running on your machine.
* This alone can save you a lot of trouble with malware in the future. See this link for a listing of some on line & their stand-alone anti virus programs:
* Click here for more information on -> Computer Safety On line - Anti-Virus
* I would recommend Grisoft's AVG or AVAST.
* These are the more secure and better ones.

Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall -
* I can not stress how important it is that you use a Firewall on your computer.
* Without a firewall your computer is susceptible to being hacked and taken over.
* Simply using a Firewall in its default configuration can lower your risk greatly.
* For an article on Firewalls and a listing of some available ones see the link below:
* Click here for more information on -> Computer Safety On line - Software Firewalls
* I would recommend ZoneAlarm as a firewall as it's easy to use.

Visit Microsoft's Windows Update Site Frequently -
* It is important that you visit http://www.windowsupdate.com regularly.
* This will ensure your computer has always the latest security updates available installed on your computer.
* If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Next, if they're not already present, I would recommend the download and installation of some or all of the following programs (all free), and the updating of them regularly

Install Spybot© - Search and Destroy- Install and download Spybot - Search and Destroy with its TeaTimer option.
* This will provide real-time spyware & hijacker protection on your computer alongside your virus protection.
* You should also scan your computer with program on a regular basis just as you would an anti virus software.
* A tutorial on installing & using this product can be found here:
* Click here for more info -->Instructions for - Spybot S & D and Ad-aware

Install Lavasofts© Ad-Aware - Install and download Ad-Aware.
* You should also scan your computer with the program on a regular basis just as you would an anti virus software in conjunction with Spybot.
* A tutorial on installing & using this product can be found here:
* Click here for more info -->Instructions for - Spybot S & D and Ad-aware

Install Javacools© SpywareBlaster -
* SpywareBlaster will added a large list of programs and sites into your Internet Explorer and Firefox settings and that will protect you from running and downloading known malicious programs.
* A article on anti-malware products with links for this program and others can be found here:
* Click here for more info -->Computer Safety on line - Anti-Malware

Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.
:thumbsup: If you wish to learn how to use HijackThis to remove malware, you might like to join the Malware Removal Training Program!

If you have any addition questions just ask...
David




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users